Multi-source cross-modal threat intelligence processing method and device, equipment and medium

Abstract

The invention belongs to the field of electric digital data processing, and particularly relates to a multi-source cross-modal threat intelligence processing method, device and equipment and a medium. Innovation of a threat intelligence processing normal form is realized through a technical route of'double-layer progressive fusion ': a cross-modal fusion layer focuses on heterogeneous feature deep coupling of natural language CTI and picture CTI, and mapping of natural language semantics and visual information is realized by adopting a three-stage processing mechanism of'intra-modal self-attention, cross-modal cross attention and LSTM time sequence fusion'; and the multi-source alignment layer is used for carrying out joint modeling on CTI feature vectors subjected to cross-modal fusion, malicious codes and log data, constructing a three-dimensional association network of a CTI knowledge graph, a malicious code graph and a log time sequence graph, and realizing cross-source semantic space unification through a heterogeneous graph attention network. The problems that when a traditional threat intelligence processing method faces multi-source cross-modal data, collection and integration are difficult, preprocessing is insufficient, cross-modal feature fusion is difficult, and knowledge graph construction is imperfect are solved.

Description

Technical Field

[0001] The present invention belongs to the field of electronic digital data processing, and particularly relates to a multi-source cross-modal threat intelligence processing method, device, equipment and medium. Background Art

[0002] In recent years, cyberattacks have shown multi-stage and multi-technology combination characteristics. The defense side needs to integrate multi-source cross-modal data such as natural language reports, malicious code, and logs to build a correlation threat awareness system. Traditional threat intelligence processing methods mainly target single-source and single-modal data, making it difficult to effectively integrate multi-source cross-modal threat intelligence. Moreover, when constructing a knowledge graph using traditional threat intelligence processing methods, the rich information of multi-source cross-modal data is often not fully utilized. The construction of a knowledge graph requires in-depth semantic understanding and relationship mining of data, and traditional methods are difficult to achieve comprehensive, accurate modeling and efficient utilization of multi-source cross-modal threat intelligence, resulting in an imperfect structure and semantic expression of the knowledge graph. In addition, there are also difficulties in fusing features of different modalities. Data of different modalities have different feature spaces and semantic information. How to effectively fuse them to form a unified feature representation to capture the associations and complementary information between different modalities is a problem that needs to be solved.

[0003] Chinese patent document CN119829942A discloses an intelligent cloud simulation multi-modal intelligence processing method, device, equipment and storage medium. An intelligence data processing model is established based on the BERT model, and a feature multi-source intelligence data set is input into the intelligence data processing model for identification. A cloud simulation platform is established, and the intelligence identification content is input into the cloud simulation platform to establish a virtual intelligence space. Real-time feedback data is obtained according to the intelligence evolution plan, and the intelligence identification content is adjusted based on the reinforcement learning algorithm to obtain target intelligence information. However, its data processing lacks pertinence. Although it can process multi-modal data, when processing threat intelligence, it does not deeply mine and analyze the characteristics of different modal data. The extraction and fusion of natural language, image and audio features are mainly achieved through NLP and CNN models, without fully considering the particularity and complexity of threat intelligence in the field of cyberspace security, and lacking in-depth mining and analysis of key information such as potential attack patterns and malicious code in threat intelligence. Secondly, the fusion effect has limitations. It uses a method of sequentially connecting the features of different modalities end to end for fusion. This simple connection method may not be able to fully capture the complex relationships and potential associations between different modalities. In practical applications, this fusion method may result in an inaccurate and incomplete feature representation after fusion, thus affecting the accuracy and reliability of intelligence analysis.

[0004] Chinese Patent Document CN116150392A performs an aggregation process on the relational features of the initial threat intelligence knowledge graph by adopting a multi-head attention layer, aggregates different semantic features to obtain attention weights of multiple preset relational types. Considering the entity characteristics based on each preset relational type, it aggregates different neighbor features of nodes through the node attention layer in the graph attention network to obtain the aggregated neighbor features of each node based on multiple preset relational types, and splices and fuses the attention weights of multiple preset relational types and the aggregated neighbor features of each node based on multiple preset relational types to obtain the final target features of each node. Finally, it performs target feature embedding to enrich the semantic information in the initial threat intelligence knowledge graph, making the semantic information of the threat intelligence knowledge graph more comprehensive and effective. However, it focuses on the processing of the semantic information of the initial threat intelligence knowledge graph, mainly aggregates relational features and node semantic information through the graph attention network, lacks stages such as comprehensive collection, preprocessing, and feature extraction of multi-source cross-modal data, lacks an effective multi-source data fusion and alignment algorithm, and is difficult to solve the problem of large differences in the feature spaces and semantic information of different modal data. The data type coverage is insufficient, and it does not mention how to integrate heterogeneous data such as natural language, pictures, malicious code, and logs, and cannot make full use of the rich information in multi-source cross-modal data to construct a complete knowledge graph, resulting in possible deficiencies in the semantic expression and structural integrity of the knowledge graph. Summary of the Invention

[0005] The present invention aims to provide a multi-source cross-modal threat intelligence processing method to comprehensively and accurately process and integrate threat intelligence from different sources and modalities, so as to solve the problems existing in traditional threat intelligence processing methods when facing multi-source cross-modal data, such as difficult collection and integration, insufficient preprocessing, difficult cross-modal feature fusion, and imperfect knowledge graph construction.

[0006] The present invention also discloses a device loaded with the multi-source cross-modal threat intelligence processing method.

[0007] The present invention also discloses an electronic device for implementing the above method.

[0008] The present invention also discloses a machine-readable storage medium for implementing the above method.

[0009] To solve the above technical problems, the present invention provides a multi-source cross-modal threat intelligence processing method, and the method includes: S1. Data collection: Construct a multi-source cross-modal four-dimensional acquisition architecture, and collect multi-source cross-modal threat intelligence data including natural language, images, malicious code, and system logs; S2. Data preprocessing: Clean, transform, and extract features from the multi-source cross-modal threat intelligence data collected in step S1 to obtain natural language feature vectors , Image feature vector , Malicious code feature vector , System log feature vector ; S3. Cross-modal feature alignment and fusion: S31. Align the natural language feature vector obtained in step S2 and the image feature vector to obtain the aligned natural language feature vector and the image feature vector ; S32. Perform intra-modal self-attention calculation on the aligned natural language feature vector and the image feature vector to obtain the natural language feature vector and the image feature vector after intra-modal self-attention calculation respectively; Perform cross-modal cross-attention fusion on and to obtain the multi-head feature vector ; S33. Concatenate the multi-head feature vector obtained in step S32 to obtain the final cross-modal fusion vector ; S4. Multi-source data fusion alignment: Adopt the cross-modal semantic alignment technology based on the graph structure to align the code feature vector and the log feature vector obtained after preprocessing in step S2 and the cross-modal fusion vector obtained after step S3 in the unified semantic space to obtain the multi-source heterogeneous graph G; S5. Knowledge graph construction: Based on the threat intelligence analysis requirements and the multi-source heterogeneous graph G after fusion alignment in step S4, construct a knowledge graph through graph pattern definition and design, knowledge extraction and fusion, storage and query optimization.

[0010] Preferably, step S1 is specifically: collect natural language threat intelligence data using a distributed crawler cluster; collect image threat intelligence data using an automated screenshot system; collect malicious code threat intelligence data using a sandbox behavior capture device; collect system log threat intelligence data using a time-series log processing pipeline.

[0011] Preferably, in step S2, by performing text segmentation and word vector representation extraction on the natural language threat intelligence data T, the natural language feature vector is obtained; By performing image size unification and feature extraction on the picture threat intelligence data the image feature vector is obtained ; By performing static and dynamic feature analysis on malicious code threat intelligence data to obtain a malicious code feature vector ; By extracting key features and performing numerical conversion on system log threat intelligence data L, a system log feature vector is obtained.

[0012] Preferably, in step S31, aligning the natural language feature vector and the image feature vector is achieved by linearly transforming the feature vectors of different dimensions, namely and and mapping them to the target dimension. Specifically: Aligning the natural language feature vector to obtain the aligned natural language feature vector is as follows: (1) Among them, is the aligned natural language feature vector, is the natural language feature vector, is the weight matrix, is the bias vector, is used to map the natural language feature vector to the target dimension; For the image feature vector , the dimension is converted to the target dimension through a fully connected layer: (2) Among them, is the aligned image feature vector, represents the fully connected layer, is the image feature vector.

[0013] Preferably, in step S32, performing cross-modal cross-attention fusion on and to obtain a multi-head feature vector , specifically: Performing a linear transformation on and obtained after in-modal self-attention calculation to obtain query Q, key and value vectors; calculating the attention score, taking the inner product of the query vector Q and the key vector and calculating the attention weights through the softmax function; multiplying the attention score by the value vector Multiply them to obtain the weighted representations of each feature vector under different attention heads; concatenate the weighted representations of each attention head and perform a linear transformation to generate the final fused representation vector , and the formula is as follows: Transform and into the query vector Query, the key-value vector Key, and the value vector Value, where the query vector comes from natural language and the key-value vector comes from an image: (3) (4) (5) Among them, is the learnable parameter matrix, Q refers to the query vector Query, refers to the key-value vector Key, refers to the value vector Value, refers to the natural language feature vector obtained after intra-modal self-attention calculation, refers to the image feature vector obtained after intra-modal self-attention calculation; The calculation formula for the weighted representation of each attention head is: (6) Among them, refers to the output of the i-th attention head, refers to the attention calculation function, refers to the query weight matrix of the i-th attention head, refers to the key weight matrix of the i-th attention head, refers to the value weight matrix of the i-th attention head, refers to the natural language feature vector obtained after intra-modal self-attention calculation, refers to the image feature vector obtained after intra-modal self-attention calculation; The multi-head feature vector is calculated as: (7) Among them, is the multi-head feature vector, h is the number of attention heads, is the final linear transformation matrix, is the multi-head attention mechanism function, refers to the output of each independent attention head, refers to the natural language feature vector obtained after intra-modal self-attention calculation, It refers to the image feature vector obtained after in-modal self-attention calculation.

[0014] Preferably, in step S33, the multi-head feature vector obtained in step S32 is concatenated to obtain the final cross-modal fusion vector , specifically: The multi-head feature vector is concatenated with the natural language feature vector after in-modal self-attention calculation to form a new feature vector ; The concatenated feature vector is input into the LSTM model, and through weight adjustment, the intermediate vector representation is obtained; Then the intermediate vector is concatenated with the image feature vector after in-modal self-attention calculation to form a new feature vector ; The concatenated feature vector is input into the LSTM model, and through weight adjustment, the final cross-modal fusion vector is obtained, where (8) (9) (10) (11) is the concatenated feature vector, is the multi-head feature vector, is the natural language feature vector after in-modal self-attention calculation, is the intermediate vector, represents the long short-term memory network, is the intermediate vector concatenated with the image feature vector after in-modal self-attention calculation to form a new feature vector, is the final cross-modal fusion vector.

[0015] More preferably, the weight adjustment is achieved through the backpropagation algorithm and an optimizer.

[0016] Even more preferably, the optimizer SGD is used to update the weights according to the gradients calculated by the backpropagation algorithm, and finally the cross-modal fusion feature vector Z is obtained.

[0017] Preferably, step S4 is specifically: Based on the malicious code feature vector obtained in step S2 and the system log feature vector Construct a malicious code call graph and a system log time series graph respectively and a system log time series graph Based on the cross-modal fusion vector obtained in step S3 Construct a cross-modal fusion network threat intelligence CTI knowledge graph Use the graph neural network HAN to generate node embeddings for each graph, solve the optimal matching matrix through the gradient descent optimization algorithm, realize the fusion alignment of multi-source data, and form a multi-source heterogeneous graph G.

[0018] Further preferably, the use of the graph neural network HAN to generate node embeddings for each graph is specifically as follows Use the heterogeneous graph attention network HAN to generate hierarchical graph node embedding vectors that retain semantic features using meta-paths (12) Where is the embedding vector of node in the th layer, is the meta-path, is the meta-path level attention coefficient, is the result after the embedding vector of node under the meta-path P is transformed, is the activation function Through the meta-path level attention mechanism, perform hierarchical feature extraction for each graph structure, and perform weighted fusion on the node embeddings under different meta-paths to obtain the final node embedding matrix (13) (14) Where is the node embedding matrix obtained by processing the graph structure through the graph neural network, is the node embedding matrix obtained by processing the graph structure through the graph neural network, is the node embedding matrix obtained by processing the graph structure through the graph neural network, is the graph neural network model, is the matrix dimension of, is the graph structure number of nodes in, is the graph structure number of nodes in, is the graph structure number of nodes in is the node set of the graph structure ; is the node set of the graph structure ; is the node set of the graph structure , and d is the dimension of the embedding vector.

[0019] Further preferably, the optimal matching matrix is solved by the gradient descent optimization algorithm to achieve the fusion alignment of multi-source data, specifically as follows: Calculate the and similarity matrix between: (15) where: is the and similarity matrix between, represents the embedding vector of node j in the graph, represents the embedding vector of node k in the graph, and sim is the similarity calculation function; Define the alignment cost function: (16) where: is the and matching matrix between, j is node j, k is node k, is the and similarity matrix between, is the graph structure ; is the graph structure ; is the alignment cost function between; the optimization goal is to minimize ; solve the optimal matching matrix by the gradient descent optimization algorithm; according to the obtained optimal matching matrix , fuse the embeddings of and ; the fused embedding is : (17) where: is the node embedding matrix obtained after fusing the graph structures and , represents element-wise multiplication, is the and The optimal matching matrix after fusion, which is used to indicate which nodes have been aligned, is the node embedding matrix obtained by processing the graph structure through a graph neural network, is the node embedding matrix obtained by processing the graph structure through a graph neural network; Calculate and the similarity matrix between after fusion : (18) Where: is and the similarity matrix between, represents the embedding vector of node in the graph, is the embedding of node j after fusion; sim is the similarity calculation function; Alignment optimization, define the alignment cost function: (19) Where: is and the alignment cost function between, is the number of nodes in the graph structure , is the number of nodes in the graph structure , is the number of nodes in the graph structure , is and the similarity matrix between, is and the matching matrix between, the optimization goal is to minimize , and solve the optimal matching matrix through the gradient descent optimization algorithm, the optimal matching matrix guides the alignment relationship between the nodes of and

[0020] Preferably, the graph pattern definition and design in step S5 are specifically as follows: determine the ontology structure of the knowledge graph, including entity types, relationship types, and the attribute definitions of entities and relationships; the knowledge extraction and fusion include extracting corresponding entity, relationship, and attribute information from the multi-source heterogeneous graph G after fusion and alignment in S4 according to the graph pattern definition; the storage is specifically: select the graph database Neo4j to efficiently store the constructed knowledge graph.

[0021] In another aspect of the present invention, a multi-source cross-modal threat intelligence processing device is provided, and the device includes: A multi-source cross-modal data collection module, which is used to collect a multi-source intelligence data set from various channels, including data in various forms such as natural language, images, logs, and code, to obtain an initial multi-source intelligence data set. The data collection module collects multi-source cross-modal threat intelligence data from various data sources according to a preset strategy and transmits it to the data preprocessing module; A data preprocessing module, which is used to preprocess the multi-source cross-modal intelligence data set and is responsible for cleaning, transforming, and feature extraction of the collected multi-source cross-modal threat intelligence data; A cross-modal feature fusion module, which is used to combine feature vectors of different modalities to form a unified feature representation, and uses intra-modal self-attention, cross-modal cross-attention mechanisms, and feature splicing and transformation technologies to realize deep coupling of heterogeneous features of natural language and picture CTI, generate a cross-modal fusion vector, and then transmit it to the multi-source data alignment module.

[0022] A multi-source data alignment module, which adopts a cross-modal semantic alignment technology based on a graph structure to align multi-source cross-modal threat intelligence data, malicious code analysis data, and system log data in a unified semantic space, solves the optimal matching matrix through an optimization algorithm, realizes the fusion alignment of multi-source data, constructs a three-dimensional association network, and finally forms a multi-source heterogeneous graph G, providing an integrated data basis for the knowledge graph construction module.

[0023] A knowledge graph construction module, which is responsible for graph pattern definition and design, selects the graph database Neo4j to efficiently store the constructed knowledge graph, extracts knowledge from the multi-source heterogeneous graph G and solves conflict problems, constructs a complete knowledge graph, stores it in the graph database for subsequent query and analysis, and realizes the comprehensive, accurate representation and efficient utilization of network threat intelligence.

[0024] In another aspect of the present invention, an electronic device is also provided, and the electronic device includes: At least one processor; and, A memory, where the memory stores instructions, and when the instructions are executed by the at least one processor, the at least one processor executes the multi-source cross-modal threat intelligence processing method as described above.

[0025] In another aspect of the present invention, a machine-readable storage medium is also provided, which stores executable instructions, and when the instructions are executed, the machine executes the multi-source cross-modal threat intelligence processing method as described above.

[0026] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention provides a "two - level progressive fusion" technical route, which overcomes the traditional fusion dilemmas and defects of traditional methods. Traditional methods directly perform global fusion on four types of heterogeneous data - natural language / pictures / code / logs, which will lead to an explosion in the dimensionality of the feature space and serious interference between modalities. For example, code features may overwhelm the semantics of natural language.

[0027] (2) The present invention realizes the innovation of the threat intelligence processing paradigm through a stepped processing architecture of "cross - modal feature fusion → multi - source data alignment". The first level is the cross - modal fusion layer, which focuses on the deep coupling of heterogeneous features of natural language CTI and picture CTI, and adopts a three - level processing mechanism of "intra - modal self - attention → cross - modal cross - attention → LSTM temporal fusion" to first realize the mapping between natural language semantics and visual information. The second level is the multi - source alignment layer, which jointly models the CTI feature vectors after cross - modal fusion with malicious code and log data, constructs a three - dimensional association network of "CTI knowledge graph - malicious code graph - log temporal graph", and realizes the unification of cross - source semantic spaces through a heterogeneous graph attention network.

[0028] (3) The present invention can enrich the structure and semantic expression of the knowledge graph. When constructing the knowledge graph by traditional methods, it is often unable to fully utilize the rich information of multi - source cross - modal data, resulting in an imperfect structure and semantic expression of the knowledge graph. Through cross - modal feature fusion and multi - source data alignment, the present invention can fully utilize the rich information of multi - source cross - modal data, making the structure of the knowledge graph more reasonable and the semantic expression more abundant. Through the application of hierarchical graph embedding representation and the heterogeneous graph attention network HAN, it can more accurately capture the complex relationships between nodes, improve the accuracy and reliability of the knowledge graph, and provide more powerful support for subsequent threat analysis and decision - making. Brief Description of the Drawings

[0029] Figure 1 It is the overall processing flow chart of Embodiment 1 of the present invention; Figure 2 It is the flow chart of two - level progressive fusion of multi - source cross - modal CTI in Embodiment 1 of the present invention; Figure 3 It is the model diagram of cross - modal natural language and picture CTI feature extraction and fusion in Embodiment 1 of the present invention; Figure 4 It is the flow chart of multi - source data graph alignment in Embodiment 1 of the present invention. Detailed Description of the Invention

[0030] Embodiment 1 The present invention provides a multi - source cross - modal threat intelligence processing method. The processing method combines Figure 1 As shown, the architecture model combines Figure 2 As shown below: S1. Data collection: Build a multi-source cross-modal four-dimensional acquisition architecture to collect multi-source cross-modal threat intelligence data including natural language, images, malicious code, and system logs.

[0031] Natural language CTI, or natural language threat intelligence data, is collected using a distributed crawler cluster; image CTI is collected using an automated screenshot system; malicious code threat intelligence data is collected using a sandbox behavior capture device; and system log threat intelligence data is collected using a time series log processing pipeline.

[0032] Collect natural language threat intelligence and collect detailed descriptions of the attack technology from sources such as MITRE ATT&CK, security blogs, and news websites. Specifically, configure the ATT&CK Navigator API interface to batch obtain TTPs technical metadata from the MITRE ATT&CK knowledge base; deploy the Scrapy-Redis distributed crawler cluster to capture natural language technical analysis reports released by security vendors such as Palo Alto Unit42 and FireEye; extract the natural language descriptions and IoC indicators of related events through the standardized interface of the MISP threat intelligence platform.

[0033] Collect threat intelligence in the form of images, and look for relevant images from security reports, blog posts, or technical forums, such as screenshots of malware interfaces or attack flowcharts. Specifically, build a PDFBox-JSON parsing pipeline to extract embedded attack flowcharts from PDF documents such as Kaspersky APT reports and Mandiant Red Team Manuals; develop a Selenium automated capture system to take regional screenshots of visual dashboards of threat intelligence platforms such as Rapid7 and Recorded Future; deploy the OCR natural language recognition engine Tesseract 5.0 to convert the technical description text in the screenshots into structured natural language.

[0034] Collect malicious code samples and obtain malicious code samples from malware sample libraries or analysis reports released by security companies. Specifically, obtain sandbox behavior logs and sample metadata through the VirusTotal Intelligence API; configure the CAPE sandbox dynamic analysis system to capture API call sequences and process tree information; perform CodeQL scanning on the GitHub code repository to identify potential malicious code snippets.

[0035] Collect log information and obtain log examples related to attack behaviors from analysis reports released by security companies, open-source log datasets, or internal system logs. Specifically, establish an Elastic Stack log processing pipeline to collect raw logs from firewalls and IDS devices; forward Windows system security logs through the Syslog-NG protocol, and focus on capturing process creation events with Event ID 4688 and login events with Event ID 4624; extract historical log archive files from the HDFS distributed storage cluster with a time span of no less than 6 months.

[0036] To improve the degree of automation, build a data pipeline based on Apache NiFi, integrate the PDFBox parser to process PDF vector graphics and the Tika natural language extractor to automatically collect open-source intelligence. Use tools such as the ELK Stack to collect and analyze log data, and adopt the Grok pattern matching engine to achieve field conversion of unstructured logs. Use the tool CAPESandbox to analyze malicious code and generate reports, and deploy the BinaryNinja plugin to extract the AST structure of the de-obfuscated code.

[0037] To ensure the correspondence between data, unify identifiers when collecting and organizing data. Establish a mapping relationship between MITRE ATT&CK technique identifiers and Cyber Kill Chain attack phases in terms of semantic association. In terms of spatio-temporal association, expand the created_time_ref field of the STIX 2.1 specification in the JSON data structure to record the ISO 8601 standard timestamps of each data source, and adopt the IEEE 1588 Precision Time Protocol (PTP) to achieve cross-device clock synchronization with a time deviation ≤ 1 ms.

[0038] Organize the collected natural language descriptions, pictures, logs, and malicious code into a unified JSON file format.

[0039] S2. Data preprocessing: Clean, transform, and extract features from the multi-source cross-modal threat intelligence data collected in step S1 to obtain natural language feature vectors 、image feature vectors 、malicious code feature vectors 、system log feature vectors ; In the data preprocessing stage, systematic cleaning, transformation, and feature extraction operations are performed on the multi-source cross-modal threat intelligence data collected in S1. The aim is to remove noise and redundant information in the data, unify the data format, and extract the feature representations of various types of data, laying a foundation for subsequent feature fusion and knowledge graph construction. This includes operations such as text segmentation and word vector representation extraction for natural language threat intelligence, image size unification and feature extraction for picture threat intelligence, static and dynamic feature parsing for malicious code samples, and key feature extraction and numerical conversion for system logs, to ensure the accuracy and usability of the data and improve the efficiency and quality of subsequent analysis and fusion.

[0040] Specifically, for the natural language threat intelligence T, the WordPunctTokenizer of the NLTK library is used to segment the natural language into words or phrases, removing stop words and punctuation marks. The word vector representation of each word is obtained. The BERT-base pre-trained model is loaded, and the tokenized natural language sequence is input , generating dynamic word vectors , performing mean pooling on the sequence word vectors to generate natural language feature vectors .

[0041] Preprocess the picture threat intelligence data , convert the original image into a format suitable for model input, while removing noise and normalizing the image data. The bilinear interpolation algorithm is used to unify the image size to 224×224 pixels, , and channel normalization is performed. The ResNet-50 pre-trained model is loaded, the last fully connected layer is removed, and the features of the penultimate layer are extracted. First, the input image is divided into multiple regions . Then each region is input into the ResNet model. For each region , after being processed by the ResNet-50 model, the feature representation of this region is obtained . The features of each region are averaged and normalized to obtain the feature vector of the entire image .

[0042] Then, for the malicious code samples Use the IDA Pro decompilation tool to parse the PE file, extract static features, extract the function call graph Call Graph and API import table, perform Abstract Syntax Tree (AST) analysis on the code, extract code structure information and count the frequency of specific code patterns. Use the CodeBERT code embedding technology to analyze dynamic behavior, convert code snippets into embedding vectors, and extract key functions and API calls as features. Use One-Hot Encoding to convert the extracted features into a numerical representation to obtain the malicious code feature vector 。

[0043] Parse log data and use the ELK Stack log parsing tool to extract key features from the logs. Configure the Grok pattern matching engine to define a regular template for parsing unstructured logs: %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} - %{DATA:event}. Use One-Hot Encoding to convert the extracted information into a numerical representation to obtain the system log feature vector 。

[0044] S3. Cross-modal feature alignment and fusion Cross-modal feature fusion combines feature vectors from different modalities, such as natural language CTI and image CTI, to form a unified feature representation for better capturing the associations and complementary information between different modalities. For each modality, it is first necessary to extract the feature vector that can represent its semantic information

[0045] S31. Align the natural language feature vector obtained in step S2 and the image feature vector to obtain the aligned natural language feature vector and the image feature vector ; Align the feature vectors of natural language CTI and image CTI obtained after preprocessing through S2 、 to align the features of different modalities into the same feature space for direct fusion operations. Map the feature vectors of different dimensions to the target dimension through linear transformation. The processing method is combined as shown in Figure 3 shown

[0046] Specifically, mapping the feature vectors of different dimensions to the target dimension through linear transformation is as follows Align the natural language feature vector to obtain the aligned natural language feature : (1) Among them, is the aligned natural language feature vector, is the weight matrix, is the natural language feature vector, is the bias vector, which is used to map the natural language feature vector to the target dimension. To ensure that the dimensions of the image feature vector and the natural language feature vector are consistent, the last fully connected layer of the ResNet network is replaced. For the image feature vector , the dimension is converted to the target dimension through a fully connected layer: (2) Among them, is the aligned image feature vector, represents the fully connected layer, is the image feature vector.

[0047] S32. Perform intra-modal self-attention calculation on the aligned natural language feature vector and the image feature vector to obtain the natural language feature vector and the image feature vector after intra-modal self-attention calculation respectively; perform cross-modal cross-attention fusion on and to obtain the multi-head feature vector ; In the embodiment of the present invention, the aligned natural language feature vector and the image feature vector are first subjected to intra-modal self-attention calculation. The multi-head self-attention mechanism is performed on the natural language features, and the number of heads h = 8 is determined through neural architecture search NAS; the patch-level attention mechanism of Vision Transformer is adopted for the image features, and the feature map is divided into a 16×16 patch sequence for processing to obtain the natural language feature vector and the image feature vector after intra-modal self-attention calculation; Perform cross-modal cross-attention fusion on and to obtain the multi-head feature vector Specifically; The and obtained after intra-modal self-attention calculation are used.Through the multi - head attention mechanism, each head can learn different semantic information, enabling the model to weight and focus on these features separately, thus better capturing the complex relationships between features.

[0048] For and perform a linear transformation to obtain the query Q, the key and the value vector. Calculate the attention scores, using the inner product of the query vector Q and the key vector , and calculate the attention weights through the softmax function. Multiply the attention scores by the value vector to obtain the weighted representation of each feature vector under different attention heads. Concatenate the weighted representations of each attention head and generate the final fused representation vector through a linear transformation .

[0049] Transform and into the query vector Query, the key - value vector Key, and the value vector Value, where the query vector comes from natural language and the key - value vector comes from an image: (3) (4) (5) Among them, is a learnable parameter matrix, Q refers to the query vector Query, refers to the key - value vector Key, refers to the value vector Value, refers to the natural - language feature vector obtained after intra - modal self - attention calculation, refers to the image feature vector obtained after intra - modal self - attention calculation. The role of the weight matrix is to convert the input feature vector into the query vector Q and perform a linear transformation on the output of the multi - head attention mechanism to generate the final fused representation. During the training process of the model, 's parameters will be updated through the backpropagation algorithm to maximize the performance metrics of the model.

[0050] Calculate the attention scores. The output of the multi - head attention mechanism consists of the results of each attention head. After linear transformation and concatenation, a comprehensive representation is obtained. For each attention head, the attention weights need to be calculated. This is achieved by calculating the inner product of the query vector Q and the key vector V and then applying the softmax function. Concatenate the outputs of multiple attention heads and perform a linear transformation to obtain the final multi - head feature vector : (6) Among them, h is the number of attention heads, is the final linear transformation matrix, is the multi-head feature vector, is the multi-head attention mechanism function, refers to the output of each independent attention head, refers to the natural language feature vector obtained after intra-modal self-attention calculation, refers to the image feature vector obtained after intra-modal self-attention calculation.

[0051] The weighted representation calculation formula for each attention head is: (7) Among them, refers to the output of the i-th attention head, is the attention calculation function, refers to the query weight matrix of the i-th attention head, refers to the key weight matrix of the i-th attention head, refers to the value weight matrix of the i-th attention head, refers to the natural language feature vector obtained after intra-modal self-attention calculation, refers to the image feature vector obtained after intra-modal self-attention calculation.

[0052] S33. The multi-head feature vector obtained in step S32 is concatenated and then fused with LSTM time series to obtain the final cross-modal fusion vector , specifically; The multi-head feature vector is concatenated with the natural language feature vector obtained after intra-modal self-attention calculation to form a new feature vector ; The concatenated feature vector is input into the LSTM model, and through weight adjustment, the intermediate vector representation is obtained. The LSTM model can capture the long-term dependence relationship in the sequence data; then the intermediate vector is concatenated with the image feature vector obtained after intra-modal self-attention calculation to form a new feature vector ; The concatenated feature vector is input into the LSTM model, and through weight adjustment, the final cross-modal fusion vector is obtained, where (8) (9) (10) (11) is the concatenated feature vector, is the multi-headed feature vector, is the natural language feature vector after in-modal self-attention calculation, is the intermediate vector, represents the long short-term memory network, is the intermediate vector and the image feature vector after in-modal self-attention calculation to form a new concatenated feature vector, is the final cross-modal fusion vector.

[0053] In LSTM processing, weight adjustment is automatically done during the training process. The weights of LSTM mainly include the weight matrices and bias vectors of the input gate, forget gate, output gate, and cell state. Weight adjustment is achieved through the backpropagation algorithm and optimizers such as Adam, SGD. The specific steps are as follows: During the forward propagation process, LSTM calculates the output and new state based on the input data and the current state: (12) (13) (14) (15) (16) Among them, is the input gate, the output value at time step t; σ is the sigmoid function, is the weight matrix of the input gate, is the input, is the hidden state weight matrix of the input gate; is the hidden state at the previous time step, is the bias term of the input gate; is the forget gate, the output value at time step t, is the weight matrix of the forget gate, is the hidden state weight matrix of the forget gate, the bias vector of the forget gate; is the memory cell, the value at time step t, storing long-term state information; ⊙ is element-wise multiplication, is the memory state at the previous time step; is the hyperbolic tangent function, an activation function; is the input weight matrix of the candidate values of the memory unit, is the hidden state weight matrix of the candidate values of the memory unit, is the bias vector of the candidate values of the memory unit; is the output gate, the output value at time step t, is the input weight matrix of the output gate, is the hidden state weight matrix of the output gate, is the bias vector of the output gate; is the hidden state, the value at time step t, which contains the output information of the current time step and will be passed to the next time step.

[0054] According to the output of the model and the true label calculate the loss function L = Loss( , ), and calculate the gradient of the loss with respect to the weights through the backpropagation algorithm: (17) where, represents the loss function, is the weight matrix of the input gate. is the weight matrix of the forget gate. is the input weight matrix of the output gate. is the input weight matrix of the candidate values of the memory unit.

[0055] Use the optimizer SGD to update the weights according to the calculated gradients, and the finally obtained cross-modal fusion feature vector is Z for subsequent use.

[0056] S4. Multi-source data fusion and alignment: Adopt the cross-modal semantic alignment technology based on the graph structure to align the code feature vectors and the log feature vectors obtained after the preprocessing in step S2 and the cross-modal fusion vector obtained after the processing in S3 in the unified semantic space to obtain the multi-source heterogeneous graph G, and the processing method is combined Figure 4 as shown.

[0057] The multi-source graph structure modeling first converts the feature representations of different data sources into graph data structures and constructs a three-dimensional association network.

[0058] Specifically, based on the malicious code feature vector and the system log feature vector obtained in step S2, construct the malicious code call graph and the system log time series graph , based on the cross-modal fusion vector Constructing a Cross-modal Fusion CTI Knowledge Graph , using the graph neural network HAN to generate node embeddings for each graph, solving the optimal matching matrix through the gradient descent optimization algorithm, realizing the fusion alignment of multi-source data, and forming a multi-source heterogeneous graph G.

[0059] Cross-modal Fusion CTI Knowledge Graph : With the attack entity as the core, based on the finally obtained cross-modal fusion vector Z, the threat intelligence after cross-modal fusion is converted into an attribute graph structure. Define three types of nodes: attacker Actor, attack technique Technique, and tactical phase Tactic. The node attributes include natural language description feature vectors, image region feature vectors, and cross-modal fusion vectors. The nodes are connected by relationship edges such as "adopting technology" and "belonging to the phase", and the edge attributes include MITRE ATT&CK technology identifiers and confidence weights. Malicious code call graph : Code features obtained based on static analysis and dynamic sandbox results , construct a function-level call relationship graph. Define that the PE file node contains a hash value, a compilation timestamp, the API call node contains a call sequence hash, and the process behavior node contains a sandbox behavior label. Use directed edges to represent the function call path, and the edge weights are calculated based on the call frequency and context relevance. System log time series graph : Log features obtained based on the timestamps of log events and the process chain , construct a time series correlation graph. Define the host node IP address, asset type, event node EventID, event level, process node PID, and execution path. Connect through time series edges such as "generating events" and "calling processes", and the edge attributes include time intervals and event trigger frequencies.

[0060] Specifically, use the heterogeneous graph attention network HAN to use meta-paths to generate node embeddings that preserve the semantic and structural information of the nodes for each graph. Use HAN to generate embeddings using meta-paths: (18) Among them, is the embedding vector of node in the layer, is the meta-path, is the meta-path level attention coefficient, is the result after the embedding vector of node i under the meta-path P is transformed, is the activation function.

[0061] Meta-path definition. For example, design a "attacker - technique - phase" meta-path for to capture the attack implementation logic chain; for Define the "file-API-process" meta-path to reveal the malicious code execution pattern; for Construct the "host-event-process" meta-path to restore the attack behavior trajectory. Node-level attention calculation, guided by each meta-path, aggregates neighborhood information through the multi-head attention mechanism, and combines the node representations of different meta-paths with weights to generate the final node embedding.

[0062] Through the meta-path-level attention mechanism, perform hierarchical feature extraction for each graph structure, and perform weighted fusion on the node embeddings under different meta-paths to obtain the final node embedding matrix: (19) (20) Among them, is the node embedding matrix obtained by processing the graph structure through the graph neural network, is the node embedding matrix obtained by processing the graph structure through the graph neural network, is the node embedding matrix obtained by processing the graph structure through the graph neural network, is the graph neural network model, is the matrix 's dimension, is the graph structure 's number of nodes, is the graph structure 's number of nodes, is the graph structure 's number of nodes, is the graph structure 's set of nodes, is the graph structure 's set of nodes, is the graph structure 's set of nodes, d is the dimension of the embedding vector.

[0063] Specifically, solve the optimal matching matrix through the gradient descent optimization algorithm to achieve the fusion alignment of multi-source data, specifically: Calculate and 's similarity matrix: (21) Among them: is and 's similarity matrix, is to represent The embedding vector of node j in the graph is denoted as the embedding vector of node k in the graph, and sim is the similarity calculation function.

[0064] Define the alignment cost function:[[]] (22) where:[[]] is the matching matrix between and is the similarity matrix between and is the number of nodes in the graph structure , is the number of nodes in the graph structure , is the alignment cost function between . The optimization goal is to minimize . Solve the optimal matching matrix and through the gradient descent optimization algorithm : (23) where:[[]] is the node embedding matrix obtained after fusing the graph structures and , denotes element-wise multiplication. is and the optimal matching matrix after fusion, used to indicate which nodes have been aligned,[[]] is the node embedding matrix obtained by processing the graph structure through a graph neural network,[[]] is the node embedding matrix obtained by processing the graph structure through a graph neural network.

[0065] Calculate and the similarity matrix between the fused : (24) where:[[]] is the similarity matrix between and is denoted as the embedding vector of node i in the graph,[[]] is The embedded node j after fusion; sim is the similarity calculation function.

[0066] Alignment optimization, define the alignment cost function: (25) Where: is and the alignment cost function between, is the number of nodes in the graph structure of, is the number of nodes in the graph structure of, is the number of nodes in the graph structure of, is and the similarity matrix between, is and the matching matrix between. The optimization goal is to minimize . Solve the optimal matching matrix through the gradient descent optimization algorithm, and the optimal matching matrix guides and the alignment relationship between the nodes of.

[0067] Through , it can be determined which nodes are corresponding in different graph structures, so as to realize the semantic and structural alignment of nodes. Specifically, and the nodes of are aligned and fused through . The aligned nodes exist as unified nodes in G, retaining the semantic and structural information from different graph structures. The edges in G not only include the edges in the original graph structure, but also include the newly established edges through alignment, and these edges represent the association relationships between different data sources.

[0068] Through the multi-source data fusion alignment of S4, a unified graph structure representation that integrates cross-modal threat intelligence, malicious code sample analysis, and system log information is finally obtained, where the nodes of each data source are aligned to form a semantically rich and clearly associated semantic unified multi-source heterogeneous graph G. This graph retains the detailed features of the original data and also establishes the internal connections between different data through cross-source alignment, providing a solid data foundation and structural framework for the subsequent construction of the knowledge graph. Based on the multi-source heterogeneous graph G, knowledge extraction, integration, and semantic representation can be further carried out on this basis to achieve comprehensive, accurate modeling and efficient utilization of network threat intelligence, and then the construction of the knowledge graph.

[0069] S5. Knowledge Graph Construction: Based on the threat intelligence analysis requirements and the multi-source heterogeneous graph G after fusion and alignment in step S4, construct a knowledge graph through graph schema definition and design, knowledge extraction and fusion, and storage and query optimization.

[0070] After completing the fusion and alignment of multi-source data, enter the knowledge graph construction stage. The purpose of this stage is to further integrate the multi-source data after fusion and alignment to form a structured and semantic knowledge graph, so as to achieve a comprehensive, accurate representation and efficient utilization of network threat intelligence.

[0071] First, perform graph schema definition and design. According to the characteristics of the fused data and the threat intelligence analysis requirements, determine the ontology structure of the knowledge graph, including entity types, relationship types, and the attribute definitions of entities and relationships.

[0072] For example, entity types: Attacker: The attacker entity can be "Alpha Hacking Team", and its attributes include name "Alpha Hacking Team", affiliated organization "Independent Hacker Organization", attack motive "economic benefit", etc. Attack Target: The attack target entity can be "e-commerce platform", and its attributes include name "e-commerce platform", type "online shopping", sensitive information "user order information", etc. Malicious Code: The malicious code entity can be "Omega Stealer", and its attributes include name "Omega Stealer", type "information stealing trojan", propagation method "phishing email attachment", etc. System Event: The system event entity can be "unauthorized file access attempt", and its attributes include name "unauthorized file access attempt", time "2023-11-20 22:15:00", affected file path " / var / www / html / data", etc.

[0073] Relationship types: An attacker uses an attack technique: For example, the relationship between "Alpha Hacking Team" and "SQL injection attack technique", and its attributes include exploitation method "obtaining database access rights by injecting malicious SQL code", impact level "medium", etc. A malicious code triggers a system event: For example, the relationship between "Omega Stealer" and "unauthorized file access attempt", and its attributes include trigger time "2023-11-20 22:15:00", trigger frequency "3 times", etc.

[0074] Next, knowledge extraction and fusion are carried out. From the multi-source data after fusion alignment in S4, corresponding entity, relationship, and attribute information is extracted according to the graph pattern definition. For entities such as attackers and attack targets in the CTI graph, they are directly mapped to the corresponding entity types in the knowledge graph, and their attribute information in the CTI graph is retained; for function and API nodes in the malicious code call graph, according to their semantic meanings in malicious code analysis, they are transformed into attribute or behavior descriptions of malicious code-related entities in the knowledge graph; for event nodes in the log time-series graph, their positions and association relationships in the knowledge graph are determined based on features such as event types and log sources.

[0075] During the knowledge fusion process, attention is paid to solving problems such as entity alignment and attribute conflicts that may exist between different data sources. Utilize the cross-source node alignment relationships established in S4 to ensure that information describing the same entity or event from different data sources can be accurately fused onto the corresponding nodes in the knowledge graph. For example, the CTI data describes a "fileless attack" technique, and its attributes include the attack method "executing malicious code using memory" and common attack targets such as "Windows system". At the same time, a code snippet is found in the analysis of malicious code samples, and its feature is "executing a malicious script in memory using PowerShell commands". Through the cross-source node alignment relationships established in S4, it is recognized that this code snippet and the "fileless attack" technique in CTI describe the same attack behavior. Then, in the knowledge graph, the two are associated, a direct edge is established, and their attribute information is integrated. The integrated knowledge graph node not only contains the description of the "fileless attack", but also includes the specific code feature "PowerShell command execution" and their common attack target "Windows system", thus enriching the content of the knowledge graph and improving the understanding and utilization efficiency of threat intelligence.

[0076] Then, storage and query optimization of the knowledge graph are carried out. Select the graph database Neo4j to efficiently store the constructed knowledge graph.

[0077] Embodiment 2 This embodiment provides a multi-source cross-modal threat intelligence processing device, and the device includes: A multi-source cross-modal data collection module, which is used to collect multi-source intelligence data sets from various channels, including data in various forms such as natural language, images, logs, and code, to obtain an initial multi-source intelligence data set. The data collection module collects multi-source cross-modal threat intelligence data from various data sources according to a preset strategy and transmits it to the data preprocessing module; A data preprocessing module, which is used to preprocess the multi-source cross-modal intelligence data set and is responsible for cleaning, transforming, and feature extraction of the collected multi-source cross-modal threat intelligence data; The cross-modal feature fusion module is used to combine feature vectors of different modalities to form a unified feature representation. By applying intra-modal self-attention, cross-modal cross-attention mechanisms, and feature splicing and transformation techniques, it realizes the deep coupling of heterogeneous features between natural language and picture CTI, generates a cross-modal fusion vector, and then transmits it to the multi-source data alignment module.

[0078] The multi-source data alignment module adopts cross-modal semantic alignment technology based on a graph structure to align multi-source cross-modal threat intelligence data, malicious code analysis data, and system log data in a unified semantic space. By optimizing the algorithm to solve the optimal matching matrix, it realizes the fusion alignment of multi-source data. It constructs a three-dimensional association network and finally forms a multi-source heterogeneous graph G, providing an integrated data foundation for the knowledge graph construction module.

[0079] The knowledge graph construction module is responsible for graph schema definition and design. It selects the graph database Neo4j to efficiently store the constructed knowledge graph, extracts knowledge from the multi-source heterogeneous graph G and resolves conflict problems, constructs a complete knowledge graph, stores it in the graph database for subsequent query and analysis, and realizes the comprehensive, accurate representation and efficient utilization of network threat intelligence.

[0080] Embodiment 3 This embodiment also provides an electronic device, including: At least one processor; and, A memory, where the memory stores instructions, and when the instructions are executed by the at least one processor, the at least one processor executes the multi-source cross-modal threat intelligence processing method as described above.

[0081] In this embodiment, the electronic device may include but is not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, and so on.

[0082] Embodiment 4 This embodiment also provides a machine-readable storage medium that stores executable instructions, and when the instructions are executed, the machine executes the multi-source cross-modal threat intelligence processing method as described above.

[0083] Specifically, a system or device equipped with a readable storage medium can be provided. On the readable storage medium, software program codes for implementing the functions of any one of the above embodiments are stored, and the computer or processor of the system or device reads and executes the instructions stored in the readable storage medium.

[0084] In this case, the program code read from the readable medium itself can implement the functions of any of the above embodiments, so the machine-readable code and the readable storage medium storing the machine-readable code constitute a part of this specification.

[0085] Examples of the readable storage medium include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Optionally, the program code can be downloaded from a server computer or a cloud via a communication network.

[0086] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solutions of the present invention, rather than limitations on the specific implementation manners of the present invention. Any modifications, equivalent replacements, and improvements made within the spirit and principle of the claims of the present invention shall be included within the protection scope of the claims of the present invention.

Claims

1. A multi-source cross-modal threat intelligence processing method, characterized in that, The method includes: S1. Data collection: Construct a multi-source cross-modal four-dimensional acquisition architecture to collect multi-source cross-modal threat intelligence data including natural language, images, malicious code, and system logs; S2. Data preprocessing: Clean, transform, and extract features from the multi-source cross-modal threat intelligence data collected in step S1 to obtain natural language feature vectors , image feature vectors , malicious code feature vectors , system log feature vectors ; S3. Cross-modal feature alignment and fusion: S31. Align the natural language feature vector obtained in step S2 and the image feature vector to obtain the aligned natural language feature vector and the image feature vector ; S32. For the aligned natural language feature vectors and the image feature vectors perform intra-modal self-attention calculations to obtain the natural language feature vectors and the image feature vectors after intra-modal self-attention calculations respectively; perform cross-modal cross-attention fusion on and to obtain the multi-head feature vectors ; S33. Concatenate the multi-head feature vectors obtained in step S32 to obtain the final cross-modal fusion vector ; S4. Multi-source data fusion and alignment: Using the cross-modal semantic alignment technology based on the graph structure, align the code feature vectors and the log feature vectors and the cross-modal fusion vectors obtained after the processing of step S3 in the unified semantic space to obtain the multi-source heterogeneous graph G; S5 Knowledge graph construction: Based on the threat intelligence analysis requirements and the multi-source heterogeneous graph G after fusion and alignment in step S4, construct a knowledge graph through graph schema definition and design, knowledge extraction and fusion, and storage and query optimization.

2. The multi-source cross-modal threat intelligence processing method according to claim 1, wherein The specific step S1 is as follows: The natural language threat intelligence data is collected by using a distributed crawler cluster; the image threat intelligence data is collected by using an automated screenshot system; the malicious code threat intelligence data is collected by using a sandbox behavior capture device; the system log threat intelligence data is collected by using a time-series log processing pipeline.

3. The multi-source cross-modal threat intelligence processing method according to claim 1, wherein, The natural language feature vector obtained in step S2 as described in step S31 and the image feature vector are subjected to feature alignment, which is It is achieved by linearly transforming the feature vectors of different dimensions, namely and mapping them to the target dimension, specifically as follows: Align the natural language feature vectors to obtain the aligned natural language feature vectors as follows: （1） Among them, is the natural language feature vector after alignment, is the natural language feature vector, is the weight matrix, is the bias vector, which is used to map the natural language feature vector to the target dimension; For the image feature vector , the dimension is transformed to the target dimension through a fully connected layer: （2） Among them, is the aligned image feature vector, represents the fully connected layer, is the image feature vector; In step S32, and are subjected to cross-modal cross-attention fusion to obtain a multi-head feature vector , specifically: After performing in-modal self-attention calculation, and are linearly transformed to obtain query Q, key and value vectors; calculate attention scores by taking the inner product of query vector Q and key vector , and calculate attention weights through the softmax function; multiply the attention scores by value vector to obtain the weighted representation of each feature vector under different attention heads; concatenate the weighted representations of each attention head and generate the final fused representation vector through a linear transformation , and the formula is as follows: Transform and into query vector Query, key vector Key, and value vector Value, where the query vector comes from natural language and the key vector comes from an image: （3） （4） （5） Among them, is a learnable parameter matrix, Q refers to the query vector Query, refers to the key-value vector Key, refers to the value vector Value, refers to the natural language feature vector obtained after in-modal self-attention calculation, refers to the image feature vector obtained after in-modal self-attention calculation; The weighted representation calculation formula for each attention head is: （6） Among them, refers to the output of the i-th attention head, refers to the attention calculation function, refers to the query weight matrix of the i-th attention head, refers to the key weight matrix of the i-th attention head, refers to the value weight matrix of the i-th attention head, refers to the natural language feature vector obtained after intra-modal self-attention calculation, refers to the image feature vector obtained after intra-modal self-attention calculation; Multi-head feature vector is calculated as follows: （7） where h is the number of attention heads, is the final linear transformation matrix, is the multi-head feature vector, is the multi-head attention mechanism function, refers to the output of each independent attention head, refers to the natural language feature vector obtained after in-modal self-attention calculation, refers to the image feature vector obtained after in-modal self-attention calculation; The multi-head feature vectors obtained in step S32 in step S33 are concatenated to obtain the final cross-modal fusion vector , specifically: Multi-head feature vector is concatenated with the natural language feature vector after in-modal self-attention calculation to form a new feature vector ; The concatenated feature vector is input into the LSTM model, and through weight adjustment, an intermediate vector representation is obtained ; Then the intermediate vector is concatenated with the image feature vector after in-modal self-attention calculation to form a new feature vector ; The concatenated feature vector is input into the LSTM model, and through weight adjustment, the final cross-modal fusion vector is obtained , where （8） （9） （10） （11） is the concatenated feature vector, is the multi-head feature vector, is the natural language feature vector after in-modal self-attention calculation, is the intermediate vector, represents the long-term memory network, is the intermediate vector and the image feature vector after in-modal self-attention calculation are concatenated to form a new feature vector, is the final cross-modal fusion vector.

4. The multi-source cross-modal threat intelligence processing method according to claim 3, wherein The weight adjustment is realized by the backpropagation algorithm and the optimizer.

5. The multi-source cross-modal threat intelligence processing method according to claim 1, characterized in that Step S4 is specifically as follows: Based on the malicious code feature vector obtained in Step S2 and the system log feature vector respectively construct a malicious code call graph and a system log time series graph , based on the cross-modal fusion vector obtained in Step S3 construct a cross-modal fusion network threat intelligence knowledge graph , use the graph neural network HAN to generate node embeddings for each graph, solve the optimal matching matrix through the gradient descent optimization algorithm, realize the fusion alignment of multi-source data, and form a multi-source heterogeneous graph G.

6. The multi-source cross-modal threat intelligence processing method according to claim 5, wherein The specific operation of using the graph neural network HAN to generate node embeddings for each graph is: Use the heterogeneous graph attention network HAN to generate hierarchical graph node embedding vectors that retain semantic features by using meta-paths: （12） Among them, represents the embedding vector of node in the layer, is the meta-path, is the meta-path level attention coefficient, represents the result after the embedding vector of node is transformed under the meta-path P, represents the activation function; Through the meta-path-level attention mechanism, perform hierarchical feature extraction for each graph structure, and perform weighted fusion on the node embeddings under different meta-paths to obtain the final node embedding matrix: （13） （14） Among them, is the node embedding matrix obtained by processing the graph structure through a graph neural network, is the node embedding matrix obtained by processing the graph structure through a graph neural network, is the node embedding matrix obtained by processing the graph structure through a graph neural network, is the graph neural network model, is the matrix dimension, is the graph structure number of nodes, is the graph structure number of nodes, is the graph structure number of nodes, is the graph structure node set, is the graph structure node set, is the graph structure node set, and d is the dimension of the embedding vector; The optimal matching matrix is solved through the gradient descent optimization algorithm to achieve the fusion and alignment of multi-source data. Specifically: Calculation and the similarity matrix between: （15） Wherein: is the similarity matrix between and represents the embedding vector of node j in the graph, represents the embedding vector of node k in the graph, and sim is the similarity calculation function; Define the alignment cost function: (16) Wherein: is the matching matrix between j is node j, and k is node k, is the similarity matrix between ; is the number of nodes in the graph structure ; is the number of nodes in the graph structure ; is the alignment cost function between, and the optimization objective is to minimize , and the optimal matching matrix is solved by the gradient descent optimization algorithm . According to the obtained optimal matching matrix , and embeddings are fused, and the fused embedding is : （17） Wherein: is the node embedding matrix obtained after the fusion of the graph structure and the optimal matching matrix obtained after the fusion of, which is used to indicate which nodes have been aligned, represents element-wise multiplication, is and the optimal matching matrix obtained after the fusion of, which is used to indicate which nodes have been aligned, is the node embedding matrix obtained by processing the graph structure through a graph neural network, is the node embedding matrix obtained by processing the graph structure through a graph neural network; Calculation After fusion The similarity matrix between: （18） Wherein: is and the similarity matrix between, represents the embedding vector of the node in the graph, is the fused node j embedding; sim is the similarity calculation function; Alignment optimization, define the alignment cost function: （19） Wherein: is the alignment cost function between and the number of nodes of the graph structure of the graph structure of the graph structure of the graph structure is the similarity matrix between and and the matching matrix between, and the optimization objective is to minimize , and the optimal matching matrix is solved by the gradient descent optimization algorithm The optimal matching matrix guides the alignment relationship between the nodes of 7. The multi-source cross-modal threat intelligence processing method according to claim 1, wherein, The specific graph schema definition and design in step S5 is as follows: Determine the ontology structure of the knowledge graph, including entity types, relationship types, and the attribute definitions of entities and relationships; the knowledge extraction and fusion include extracting the corresponding entity, relationship, and attribute information from the multi-source heterogeneous graph G after fusion and alignment in S4 according to the graph schema definition; the storage is specifically: Select the graph database Neo4j to efficiently store the constructed knowledge graph.

8. An apparatus for a multi-source cross-modal threat intelligence processing method, characterized in that, The device includes: A multi-source cross-modal data collection module, which is used to collect multi-source intelligence data sets from various channels, including data in various forms such as natural language, images, logs, and code, to obtain an initial multi-source intelligence data set. The data collection module collects multi-source cross-modal threat intelligence data from various data sources according to a preset strategy and transmits it to the data preprocessing module; A data preprocessing module, which is used to preprocess the multi-source cross-modal intelligence data set and is responsible for cleaning, transforming, and feature extraction of the collected multi-source cross-modal threat intelligence data; A cross-modal feature fusion module, which is used to combine feature vectors of different modalities to form a unified feature representation, and uses intra-modal self-attention, cross-modal cross-attention mechanisms, and feature splicing and transformation technologies to realize the deep coupling of heterogeneous features of natural language and picture CTI, generate cross-modal fusion vectors, and then transmit them to the multi-source data alignment module; The multi-source data alignment module uses cross-modal semantic alignment technology based on graph structure to align multi-source cross-modal threat intelligence data, malicious code analysis data, and system log data in a unified semantic space. By optimizing the algorithm to solve the optimal matching matrix, it realizes the fusion alignment of multi-source data, constructs a three-dimensional association network, and finally forms a multi-source heterogeneous graph G, providing an integrated data foundation for the knowledge graph construction module. The knowledge graph construction module is responsible for graph pattern definition and design. It selects the graph database Neo4j to efficiently store the constructed knowledge graph, extracts knowledge from the multi-source heterogeneous graph G and solves conflict problems, constructs a complete knowledge graph, stores it in the graph database for subsequent query and analysis, and realizes the comprehensive, accurate representation and efficient utilization of network threat intelligence.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory that stores instructions which, when executed by the at least one processor, cause the at least one processor to execute the multi-source cross-modal threat intelligence processing method according to any one of claims 1-7.

10. A machine-readable storage medium storing executable instructions, characterized in that, When executed, the instructions cause the machine to execute the multi-source cross-modal threat intelligence processing method according to any one of claims 1-7.

Images